How to Stop Email Spoofing: Fix SPF, DKIM, and DMARC for Your Domain

If you’re receiving strange emails that appear to come from your own domain, you’re not alone.

For example, you might receive an email from:

no-reply@yourdomain.com

even though you never sent it.

When these emails are forwarded to Gmail, you may see warnings such as:

• Be careful with this message
• This message may not have been sent by yourdomain.com
• Gmail couldn’t verify that this message actually came from yourdomain.com

The good news is that this usually does not mean your website or email account has been hacked. In most cases, it’s a problem called email spoofing.

This guide explains how to identify spoofed emails and configure SPF, DKIM, and DMARC correctly to protect your domain.

What Is Email Spoofing?

Email spoofing is when someone sends an email using your domain name without your permission.

For example, an attacker can send:

From: no-reply@yourdomain.com

using their own mail server somewhere else in the world.

They don’t need access to your hosting account or email account to do this.

Without proper email authentication, receiving mail servers cannot always determine whether the email is genuine.

How to Identify a Spoofed Email

If you use Gmail, open the suspicious email and click:

More (⋮) → Show Original

Look for these authentication results.

SPF

spf=fail

DKIM

dkim=none

or

dkim=fail

DMARC

dmarc=fail

You should also inspect the sending IP.

Example:

Received: from [41.122.140.42]

If your website is hosted on a different server, such as:

88.222.209.7

then the email clearly did not originate from your hosting server.

This strongly indicates email spoofing rather than a hacked website.

Understanding SPF

SPF (Sender Policy Framework) tells other mail servers which systems are allowed to send email for your domain.

A typical SPF record looks like this:

v=spf1 include:relay.mailchannels.net include:spf.smtp2go.com -all

If someone sends email from an unauthorized server, SPF will fail.

Example:

spf=fail

A failed SPF means:

The sending server is not authorized to send email for your domain.

Important Rules for SPF

• Only publish one SPF record.
• Include every legitimate email provider you use.
• End the record with -all once everything is configured correctly.

Understanding DKIM

DKIM (DomainKeys Identified Mail) digitally signs every outgoing email.

When an email reaches Gmail, Outlook, or Yahoo, they verify the signature.

If the signature is valid:

dkim=pass

If no signature exists:

dkim=none

Without DKIM, anyone can more easily impersonate your domain.

If you use multiple email providers, each one should have its own DKIM configuration.

For example:

• DreamHost
• Microsoft 365
• Google Workspace
• SMTP2GO
• Amazon SES

Understanding DMARC

DMARC works together with SPF and DKIM.

It tells receiving mail servers what to do when authentication fails.

There are three policies.

Policy: None

v=DMARC1; p=none;

This only reports failures.

Spoofed emails can still be delivered.

Policy: Quarantine

v=DMARC1; p=quarantine;

Suspicious emails are usually sent to the spam folder.

Policy: Reject

v=DMARC1; p=reject;

Spoofed emails are rejected before reaching the recipient.

This is the strongest protection.

A Common Hosting Setup

Many websites use different providers for different services.

For example:

• Website hosting: Hostinger
• Email hosting: DreamHost
• DNS: Cloudflare
• Website SMTP: SMTP2GO

This is perfectly acceptable.

However, your DNS records must authorize every service that legitimately sends email.

Does SPF Affect My Contact Form?

It depends on how your website sends email.

If you use SMTP

If your contact form sends mail through SMTP2GO, Google Workspace, Microsoft 365, or another SMTP service, SPF should authorize that provider.

Your website hosting server does not need to appear in SPF if it never sends mail directly.

If you use PHP mail()

If WordPress sends mail directly from the hosting server using PHP mail(), your hosting provider must also be included in SPF.

Otherwise, your website emails may fail SPF.

How to Configure SPF Correctly

If your domain uses:

• DreamHost email
• SMTP2GO for website emails

your SPF should authorize both services.

For example:

v=spf1 include:relay.mailchannels.net include:spf.smtp2go.com -all

Your exact SPF record may vary depending on your providers.

Always follow the current documentation from each email provider.

How to Configure DKIM

Every email service should provide a DKIM record.

In Cloudflare DNS, this is usually added as either:

• TXT record
• CNAME record

After adding the record, send a test email and verify:

dkim=pass

How to Configure DMARC

If you are just starting, use:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com;

Monitor your reports for several days.

Once you’re confident every legitimate sender is authenticated, change the policy to:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com;

This provides the best protection against spoofing.

How to Test Your Configuration

After updating DNS:

1. Send an email from your mailbox.
2. Submit your website contact form.
3. Send both emails to a Gmail account.
4. Open Show Original.

You should see:

SPF: PASS
DKIM: PASS
DMARC: PASS

If all three pass, your domain is properly authenticated.

Common Mistakes

Avoid these common configuration errors:

• Publishing multiple SPF records
• Forgetting to include every email provider
• Missing DKIM records
• Leaving DMARC set to p=none
• Sending website emails directly with PHP mail() instead of authenticated SMTP

Final Thoughts

Email spoofing is one of the most common problems affecting business domains. Fortunately, it is also one of the easiest to prevent.

By correctly configuring SPF, DKIM, and DMARC, you can significantly reduce the risk of attackers impersonating your domain. Most major email providers, including Gmail, Outlook, and Yahoo, will use these authentication records to verify legitimate messages and reject forged ones.

If your domain uses separate providers for hosting, email, DNS, and website SMTP, take the time to ensure each service is properly authorized. A few correctly configured DNS records can dramatically improve both your email security and your email deliverability.